[Jammy2211]

Closes #557. Phase 3b of the autonomous-orchestrators epic — real claude --bg workers on the 3a watcher core. Read with PyAutoLabs/PyAutoMind#525 (merge that one first).

What changes

• worker_template.md (new) — the one prompt every real worker starts from: Use the start-dev skill. <path> --auto, the brief path, end-at-deliverable (no timers), never commit to PyAutoMind directly, write <lease>/<task>.done with the PR URLs.
• _orchestrator.py — session_command() → claude --bg --name shift:<task> --permission-mode <mode> <prompt> (a test pins it is never bare); RealSpawner parses the printed backgrounded · <id> · <name> id into the lease. AgentsView reads claude agents --json --all once per tick: working → heartbeat; blocked → stalled_since, parked after 15 min (never killed, never re-dispatched); done + marker → released; done without → crashed (3a's re-dispatch-once). transcript_tokens() sums input + output + cache-creation from the worker's local transcript (named by the full sessionId); the brief's token-budget: refuses the next spawn once spent. Real dispatch requires sandbox: yes until 3c (one Mind writer).
• _brief.py — worker-mode: (default auto, human decision 2026-11-03; bypassPermissions refused by name) and sandbox:.
• Conductor AGENTS.md "The watcher" — real mode, stall parking, token budget, the trust requirement.
• Tests — tests/test_orchestrator_dispatch.py (17 + 1 opt-in live); the 3a "refused until 3b" test now asserts the sandbox fence.

Found against the real CLI (2.1.316) while witnessing — already handled

• claude --bg ignores --session-id and assigns its own; workers are tracked by the printed short id, the full sessionId comes from claude agents --json (only needed to find the transcript).
• The live state word is working, not running; anything but blocked / done reads as alive.
• claude --bg refuses an untrusted folder at once (exit 1, "Workspace not trusted") — a fast failure, never a stall; the spawn leaves no lease. Workers launch from the workspace root; task worktrees under the -wt root are untrusted by default — trust that root once by hand if workers are ever launched there.

Tier: judge — merge mode: human /prm. Heart YELLOW reason set acknowledged by the human at ship.

Witness

$ pytest tests/test_orchestrator_dispatch.py -v   (fake claude + fake agents view)
test_session_command_is_never_bare  PASSED
test_bypass_permissions_is_never_a_worker_mode  PASSED
test_default_worker_mode_is_auto_and_overridable  PASSED
test_real_spawn_records_the_session_in_the_lease  PASSED
test_a_failed_spawn_leaves_no_lease  PASSED
test_real_dispatch_outside_a_sandbox_brief_is_refused  PASSED
test_a_running_worker_keeps_its_lease  PASSED
test_a_blocked_worker_is_parked_after_the_grace_and_never_redispatched  PASSED
test_a_worker_that_unblocks_clears_its_stall  PASSED
test_done_with_its_marker_is_released_and_its_tokens_counted  PASSED
test_done_without_its_marker_is_a_crash  PASSED
test_a_vanished_worker_waits_out_the_lease_grace  PASSED
test_a_spent_token_budget_refuses_the_next_spawn  PASSED
test_transcript_tokens_sums_input_output_and_cache_creation  PASSED
test_agents_view_reads_the_cli_once  PASSED
test_brief_validates_sandbox_and_worker_mode  PASSED
test_an_untrusted_folder_fails_the_spawn_fast  PASSED
test_live_sandbox_worker  SKIPPED

$ PYAUTO_ORCHESTRATOR_LIVE=1 PYAUTO_ORCHESTRATOR_LIVE_CWD=<workspace root> pytest -k live -s   (one real claude --bg worker, run on the laptop 2026-11-03)
live states: ['working', 'done']
live tokens: 26510
1 passed — worker removed afterwards (claude agents --json shows no shift:* sessions)

$ pytest tests/test_orchestrator_watcher.py   → 16 passed in 1.63s
$ repos_sync.py --check --only 'tenant firewall (organ code)' --root <task worktree>   → OK
full suites (PYAUTO_* unset): PyAutoBrain 1473 passed, 1 skipped in 132.60s (0:02:12)  ·  PyAutoMind 712 passed in 60.53s (0:01:00)
lifecycle.py check: DRIFT only the pre-existing active/chapter2-explanations.md

🤖 Generated with Claude Code